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Abstract 

We present some theoretic bounds and algorithms concerning the 
statistics of different reduction types in the family of Fermat curves 
YP = V'^(l — X), where p is prime and s = 1, . . . ,p — 2. 

1 Introduction 

For a prime p, we define Sp = {1, . . . ,p — 2}, and consider the family of 
curves 

Ts- YP = X%1-X), seSp, 

over the algebraic closure of Q. 

It has been shown by McCallum [16] (see also [lH ITTl |18]) that there 
is a direct link between the properties of the reduction of J^g modulo p (in 
particular to tame, wild split and wild non-split reductions) and the Fermat 
quotients. 



We recall that for a prime p and an integer u with gcd('U,p) = 1 the 
Fermat quotient qp{u) is defined by the conditions: 



qp{u) 



uP-^ - 1 



(mod p) 



and 



< qp{u) < p. 



p 



We define the sequence of Legendre symbols: 



p,s 



( 



2s(s + l)gp(sV(s + 1)^+1) 



p 



) 



s e Sj 



By a result of McCallum [H] (see also [l5l[I71|T8]), the curve Fg is tame, wild 
split or wild non-split depending on whether {}p^s = 0, 1 or —1, respectively. 

For = 0,±1, we define N^{p) as the number of integers s E Sp with 
^p,s = ^- A natural conjecture is that 2s(s + l)qp {s'^ / {s + l)*"*"^) behaves 
uniformly randomly modulo p, and that the values for the various s are 
independent. Therefore one expects i^p^g = ±1 both occur about half the 
time, and i)p^s = occurs for about 1/p values of s on average. In other 
words, one expects that Nq{p) behaves like a Poisson random variable with 
mean 1, and that N±i[p) behave like normal random variables with mean 
p/2 and variance p/2, as p ^ oo. 

We show that these heuristics are not quite correct: there are relations 
among the 'dp^s, so that the independence hypothesis must be modified. After 
adjusting our heuristics to take into account these relations, we find excellent 
numerical agreement with a table of values of A''o,±i(j9) for p < 10^. 

We also prove that Nq{p) = 0(p^/^). This confirms that 'dp^s = occurs 
relatively rarely. Unfortunately this bound is much weaker than the bounds 
suggested by our numerical experiments. 

Clearly the question about the distribution of the values of N±i{p) is 
essentially a question about bounding a certain sum of Legendre symbols 
with Fermat quotients. Recently there has been some progress in the area of 
estimating multiplicative character sums with Fermat quotients qp{u), see |3l 
EU [251 EH]. However, the results and methods of these papers do not seem 
to apply to sums corresponding to {}p^s- 
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2 Preparations 



Our bound of No{p) is based on the following bound of Heath-Brown [TT| 
Lemma 2] (see also [I9|). Let 



Lemma 1. For any integer r the congruence 

f{u) = r (mod p), 2 < u < p — 1, 
has 0(p^/^) solutions. 

We also recall some notions and the results from the uniform distribution 
theory, see [6]. As usual, we define the discrepancy A(r) of a sequence 
r = (7m)m=i of ^ (^o^ necessarily distinct) points in the unit interval [0, 1] 
by 

^r(7) 

A(r) = sup 

0<7<1 



M 
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where /r(7) is the number of points 7^, of V with 7^, < 7. 
We trivially have: 

Lemma 2. Let<P = {^Pm)m=i ^.f^d^ = {ipm)m=i ^'^^ sequences of M points 
in the unit interval [0, 1] with lyj^ — < 5, m = 1, . . . , M . Then for their 
discrepancies we have A(^) = A(!l^) + 0(5). 

The following result about the distribution of modular inverses is well- 
known, see [271 Section 3] for a survey of several similar estimates. It has 
appeared in many works, and follows instantly from the Weil bound for 
Kloosterman sums, see [121 Theorem 11.11]. 

Lemma 3. For any prime I and integers ^ < K < K+R < i the discrepancy 
of the sequence f / 1, r G [K^K + R\ is O (-R~^£^/^(log£)^), where f is defined 
by the congruence 

rr = 1 (mod i), 1 <r < i — 1. 

Let, as usual, vr(X) denote the number of primes i < X. Then we have 
the following lower bound, due to Baker, Harman and Pintz [1] for primes in 
short intervals, see also [121 Section 10.5] for several related results. 



3 



Lemma 4. There in an absolute constant c > such that for Y > X°-^^^ we 
have tt{X + Y)- tt{X) > cY/\ogY. 

Finally we need some algorithmic results. We measure the complexity 
of our algorithms in the so-called RAM model of computation, see [TU] for a 
background. 

Since we are mostly interested in theoretic estimates, we always assume 
that fast arithmetic of long integers is used and in particular any arithmetic 
operation on n-bit integers can be performed in time n^^°^^^ as n — )■ oo, 
see [ini Theorem 8.23]. 

Besides we recall that for any prime p and integers a, b and k, all at most 
n-bits long, we can 

• compute the residue a*^ (mod p) in time n^~^°^^\ see [101 Section 4.3]. 

• compute the Legendre symbol (a/p) in time n^^"^^\ see [2]; 

• find an integer solution {u, v) of the linear equation au — bv = 1 in time 
n^+°(i), see [20]. 

We use these estimates throughout Sections H] and |5l 

3 Bounding Nq{p) 

The upper bound for Nq{p) is immediate from Lemma [TJ 
Theorem 5. We have 



for any integers u and v with gcd{uv,p) = 1, see, for example, [7| Equa- 
tion (3)]. 
Therefore 



No{p) = 0{p'/'). 



Proof. It is easy to verify that 



qp{uv) = qpiu) + qpiv) (mod p) 



(1) 



qp (s7(s + 1)^+1) = sqp{s) - (s + l)qp{s + 1) 




(2) 
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It is shown by Heath-Brown [TTl Section 1] that for 1 < s < p — 2 

= /(s + l) (modp), 

P 

where f{u) is as in Section [2l Applying Lemma [1] we conclude the proof. □ 

Therefore the curve = X^(l — X) is tame for at most 0{p'^^^) positive 
integers s < p — 1. 

It has been shown in the proof of [T8i Lemma 6.1] that for p = 1 (mod 3) 
we have -dp^g = for both roots s of the congruence + s + 1 = (mod p). So 
No{p) > 2 for p = 1 (mod 3). We are not aware of any other lower bounds. 



4 Computing N^{p) 

We start with an observation that the known algorithmic results presented 
in in Section [2] imply that the values of iVo,±i (p) can be computed directly 
from the definition in time and space 

T = p(logp)2+°(i) and S = O(logp), 

respectively. Indeed, this follows instantly from the congruence 

qp {s'/{s + iy+^) = sqp{s) - [s + l)qp{s + 1) (mod p) 

that is based on ([1]) and which we have used in the proof of Theorem [51 

If memory is not of concern, we can simply compute the table of the 
values of qp{s), s = 1, . . . ,p — 2, in 0(1) arithmetic operations modulo p per 
value, see [211 Theorem 7]. After this, using fast arithmetic for the Legendre 
symbol, we can compute Nq^±i{p), in time and space 

T = p(logp)^+°(^) and S = O(plogp), 

respectively. 

Furthermore, using f2T\ Algorithm 8] one can have some trade-off between 
the space complexity and running time of computing N^{p). Indeed, for any 
parameter Z > 2, we can evaluate in time pZ~^ {log pY^°^^^ a certain table 
(of size O {pZ~^ \ogp)) such that after this for each s = l,...,p — 2we can 
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compute 'dp^s in time (log p)^"*""*^^^ log Z, see [2T1 Theorem 9]. Thus for any 
Z > 2, we can compute Nq^±i{p) in time and space 

T = p(logp)^+°(^) log Z and S = {pZ'^ \ogp) , 

respectively. Clearly Z = p corresponds to the above trivial algorithm. How- 
ever, taking Z = exp [y/\og p) we see that we can compute No^±i{p) in time 
p(logp)^/^~*"''(^^ and space pexp (—(1 + o(l))-\/log p) . 

5 Approximating N^{p) 

We now design Quasi-Monte Carlo type algorithms that evaluate '^p^s on 
a sequence of s that is asymptotically uniformly distributed in the interval 
— 2] and have much more modest space requirements that the algorithms 
of Section HI 
Let 

U = \p^/^] and A = \p^/Hogp] . 

We now precompute and store the table Q of values qp{w), I < w < U, which 
can be done in in time and space 

T = pi/2(iQgp)2+o(i) S = Oip'^Hogp), (3) 

respectively. This is the cost of preprocessing. 

Let £ be the set of primes £ E [U — A,U] and let 71 be the set of integers 
r E [U — 3A, U — 2 A]. We now recall the complexity bounds of Section [2] 
and proceed as follows: 

Algorithm 6 (Using Linear Equations). 

Step 1: Select at random a prime i E C and an integer r eTZ. 

Step 2: Find positive integers u < r and v < i with rv — iu = 1 in time 
(logp)i+°(i). 

Step 3: Set s = iu. 

Step 4: Using the precomputed table Q and applying we compute 
Qp {s'/{s + 1)'+^) = sqp{i)qp{u) - {s + l)qp{r)qp{v) (mod p), 
and then "dp^s, in time (logp)^^"*^"'^^ 
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Thus after the preprocessing with the cost given by we compute 'dp^s 
for every s G iS in essentially linear time, where S is the set of s generated 
at Step 2 of the above algorithm. That is, 

S = {s = iu : rv - iu = 1, i e C, r eU, < u < r}. 

We now show that indeed the above algorithm samples s in a reasonably 
uniform fashion. 

Theorem 7. The discrepancy of the sequence {s/p)s,^s is O (p~^/^logp). 

Proof. First of all we note that Lemma S] applies to the set C so it is not 
empty and contains at least coA/logp primes, for some absolute constant 
Co > 0. Furthermore, distinct pairs {i,r) & C x TZ lead to distinct products 
s = iu. 

Clearly for £ G £ and r G 7^ we have 

£r = [/2 + 0{UA) =p + 0{UA). 

Therefore, 

s iu rv 1 rv 1 v ^ /UA\ 

p p p p £r + 0{UA) pi \ P J 

Using Lemmas [2] and [3l we see that the discrepancy of the sequence of 
fractions s/p with s G iS corresponding to a given value of i is 

O {A-'U'/\\ogUf + UAp-') = O (p-^/^logp) . 

Obviously the discrepancy of the entire sequence {s/p)ses also satisfies the 
same bound. □ 

Unfortunately the proof of Theorem [7] takes no advantage of averaging 
over i. So, this certainly can be a way to obtain a further improvement. 
In particular, it is possible that the switching over argument of Fouvry [8] 
maybe of help here. 

The above approach is based on constructing suitable values of s from 
solutions of linear equations with the coefficients i and r running indepen- 
dently through some prescribed sets. There are various possible modifica- 
tions that may lead to algorithmic advantages, and there are a variety of 
results in El m [221 123] that can be used to prove the analogues of Theorem [7] 
about the uniformity of distribution of the corresponding values of s. 

Clearly Algorithm |6] makes sense only if one intends to compute "^p^s for 
at least p^/^ \ogp values of s. 
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6 Relations between ^ 



p,s 



Define permutations F,G : Sp ^ Sp by 



1 — s (mod p) 



G{s) = l/s (mod p). 



One checks that F"^ = = (FG)^ = id^^, so the group H generated by F 
and G contains at most six distinct permutations, namely 1, F, G, FG, GF, 
and FGF (= GFG). Furthermore, F, G and FGF each have a single fixed 
point (respectively —1/2, 1, and —2 modulo p), and the fixed points of FG 
and GF are the roots of + a; + 1 = (mod p) (if they exist). 

From these facts one can easily determine the number of orbits of Sp 
under H, as follows. Assume that p > 11, so that —1/2, 1, —2, and the roots 
of + x + 1 = (mod p), are all distinct modulo p. First suppose that p = 1 
(mod 3). Let sq and si be the roots of + x + 1 = (mod p). Note that 
F and G interchange Sq and Si. Thus there are precisely {p + 5)/Q orbits, 
namely {—1/2, 1, —2}, {sq, Si}, and (p — 7)/6 orbits of order 6. Now suppose 
that p = 2 (mod 3). Then + x + 1 = (mod p) has no roots, and we 
obtain {p + l)/6 orbits, namely { — 1/2, 1, —2} and {p — 5)/6 orbits of order 



In all cases, we see that there are p/6 + 0(1) orbits. Next we show that 
i)p^s is constant on each orbit. 

Theorem 8. We have ^p,F{s) = ^p,s and ^p,G{s) = ^p,s- 

Proof. We will use the fact that for any u, v G Z, with u (mod p), 



6. 



qp{u + vp) 



[u + vpf-^ - 1 



p 

^p-i + (p — l)u^~'^vp — 1 



(4) 



p 



qpiu) 



V 



(mod p) 



u 




2s{s + 1) {sqp{s - p) - (s + l)qp{s + I - p)) 
p 
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The result then follows from 

qp{s -p) = qp{s) - ^ (mod p) 

and ^ 

qp{s + 1 - p) = qp{s + 1) — - (modp). 

S ~r -L 

For the second relation, 

'2s-\s-' + 1) - is-' + l)qp{G{s) + 1)) 



p 

2s{s + 1) - (s + l)qp{G{s) + 1)) 



p 

since (s'^/p) = 1. Now let sG(s) = 1 + kp for some /c G Z. Then 

qp{G{s)) = qp{sG{s)) - gp(s) = gp(l) - A; - gp(s) = -A; - gp(s) (mod p) 
and 

gp(G(s) + 1) = qp{sG{s) + s) - gp(s) = qp{s + 1) — - - qp{s) (mod p). 

Therefore 

gp(G(s)) - (s + l)gp(G(s) + 1) = sqp{s) - {s + l)qp{s + 1) (mod p), 

and 'i9p,G(s) = ''^p.s as desired. □ 

A natural question is whether there is some geometric explanation for the 
above relations. For example, are there maps between J-'f{s) and J^g{s) 
that force them to have the same reduction type? 



7 Numerical Results 

We have computed iVo,±i(p) for all p < 10'' using a C implementation of a 
fairly naive algorithm. 

Table [Ugives a statistical summary of the distribution of Ni{p). The data 
for N^i{p) is similar and is not shown. The table has been constructed in 



9 



Table 1: Moments 
k 



of normalised Ni{p), for 3 < p < 10 



1 -0.00085 

2 0.99979 

3 0.00051 

4 3.00059 

5 0.00403 

6 14.92162 

7 -0.07897 

8 102.90932 




1 

3 


15 


105 



the following way. Following the results of the previous section, Ni{p) should 
behave like a sum of p/6 independent random variables that take the values 
6 and with equal probability. Each such variable has mean 3 and variance 
9, so under this assumption we expect Ni{p) to have mean 3(p/6) = p/2 and 
variance 9{p/6) = 3p/2. We treat each prime p as an 'observation' of Ni{p), 
and define a normalised random variable 



Table [T] shows the moments of X, compared to the moments of the standard 
normal distribution. The closeness of the fit strongly supports the assump- 
tions of our model. 

Table [2] summarises the behaviour of Nq{p). If we assume that "t^p^s takes 
the value with probability 1/p on each of the p/6 + 0(1) orbits, then we 
expect No{p)/6 to behave like a Poisson random variable with mean 1/6. In 
Table [21 the column T2{k) counts the number of primes p = 2 (mod 3) such 
that Nq{p) = 6k; it closely matches the last column, which shows the value 
predicted by the Poisson model. For p = 1 (mod 3) we must modify this 
slightly, because we know that automatically "dp^s = when s is one of the 
roots of + s + 1 = (mod p) (see Section [3]). This effectively increases 
Nq{p) by two. In the table, we correspondingly define Ti[k) to be the number 
of primes p = 1 (mod 3) such that Nq{p) = 6k+2. Again this closely matches 
the Poisson model. 



X 



N^{p)-p/2 
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Table 2: Frequency table for No{p), for 5 < p < 10'', p ^ 1093, 3511 
k Ti{k) T2{k) Poisson prediction 



By definition, the latter is zero modulo p if and only if p is a Wieferich prime. 
There are only two known Wieferich primes, namely 1093 and 3511. For these 
two primes, -dp^s is zero on the orbit {1,-1/2,-2}. In fact iVo(3511) = 5 and 
A^o(1093) = 17 . 

8 Comments 

We remark that in the range of our calculations of Nq^±i{p), none of the 
asymptotically faster algorithms of Sections H] and [5] were used. We how- 
ever believe that these algorithms are not only of theoretic interest and can 
become more practically useful for large values of p. 

We note that the definition of i)p^s makes sense for any integer s with 
gcd(s(s + l),p) = 1 and then it obviously becomes a periodic function of s 
with period p"^. Furthermore, a more careful analysis shows that it is periodic 
with period p. Indeed, using we see that 



281486 281127 

1 46619 47088 

2 3860 3923 

3 217 231 

4 10 14 



281277 
46879 
3906 

217.03 
9.043 



Finally, one computes that 




{u + p)qp{u + p)= uqp{u + p) = uqp{u) - 1. 



Now, recalling ([2]), we derive 



gp((s+p)^+7(s+p+ 1)^+^+1) 

= (s + p)qp{s + p) - (s + p + l)qp{s + p + 1) 

= sqp{s) -{s + l)qp{s + I) = qp (sV(s + iy+') (mod p). 
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This explains why it is enough to study the values of -^p^s only for s G Sp. 
This can also be used in numerical tests as one can use any values of s for 
which the relevant values of qp are easy to are easy to compute. 

For instance, assume that we want to compute A^o,±i(p) for many primes 
p < X. Then we can try to find a large set iS of s G [1,^] (together with 
their factorisations) such that s and s + 1 are y-smooth (that is, whose 
prime factors are all less than Y). Then, for each p, we compute and store 
the values of qp{i) for all primes i < Y. After this ^p^s, s G iS, can be 
computed very rapidly. Certainly for this approach to work, we need to 
know for what Y there many such integers s and how they are distributed 
in However, we remark that the questions of counting and generating 

smooth pairs (s, s + 1) is apparently very difficult, see [131 Section 6]. 

We can expand further the set of potentially "friendly" test points by con- 
sidering triples [u, v, w) of F-smooth positive integers u,v,w < X. After this 
we compute t = u/w (mod p"^) and then compute s E Sp with s = t (mod p). 
We now have -^p^g = '&p,ti while t is a "friendly" value. Unfortunately counting 
and generating such triples {u,v,w) is still a difficult problem, see [121 [II]. 
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